Methods and systems for controller-based secure session key exchange over unsecured network paths

• US 10,110,422 B2
• Filed: 09/16/2015
• Issued: 10/23/2018
• Est. Priority Date: 09/16/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Cloudgenix, Inc. (Palo Alto Networks Incorporated)
• Inventors: Yadav, Navneet, Ramasamy, Arivu, Edwards, Aaron
• Primary Examiner(s): Shin, Kyung H
• Application Number:
  US14/856,482
• Publication Number:
  US 20160080502A1
• Time in Patent Office: 1,133 Days
• Field of Search: 709227, 726 4
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 : based on throughput or bandwidth
• CPC Class Codes: H04L 45/22 : Alternate routing
• CPC Class Codes: H04L 45/28 : using route fault recovery
• CPC Class Codes: H04L 45/302 : Route determination based on requested QoS
• CPC Class Codes: H04L 45/306 : Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 : Flow based routing
• CPC Class Codes: H04L 47/125 : by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/22 : Traffic shaping
• CPC Class Codes: H04L 47/24 : Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/32 : by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 47/781 : Centralised allocation of resources
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 : using domain name system [DNS]
• CPC Class Codes: H04L 61/4523 : using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks

Abstract

A method includes generating at a multi-tenant controller on a network a common shared secret for establishing a link between a first site and a second site, transmitting the shared secret to each of the first site and the second site over a secured channel, assigning a wall clock based start and end validity period for the shared secret, sending the shared secret with a future validity to allow secure link communication to continue if one or more elements in both sites cannot communicate with the multi-tenant controller and using a separate shared secret per link per VXWAN.

Claims

1. A method comprising:

determining, by a multi-tenant controller on a network, that a link should be established between a first site and a second site on the network;

if a determination is made that a link should be established between the first site and the second site, then generating, by the multi-tenant controller on the network, a unique common shared secret for establishing a secure link between the first site and the second site;

transmitting, by the multi-tenant controller, the unique common shared secret to both the first site and the second site over a secured certificate authenticated channel;

assigning, by the multi-tenant controller, a wall clock based start and end validity period for the common shared secret;

wherein the common shared secret is transmitted with a validity period in the future to allow secure link communication between the first site and the second site to continue, using a secure session key derived from the common shared secret, if one or more elements in both the first and the second site cannot communicate with the multi-tenant controller; and

using a unique corresponding shared secret for each link per VXWAN (virtual extensible wide area network).

2. The method of claim 1, wherein generation of the shared secret is performed by software.

3. The method of claim 1, wherein generation of the shared secret is performed by hardware.

4. The method of claim 1, wherein generation of the shared secret is performed by a software and hardware hybrid.

5. The method of claim 1, wherein a network connectivity is physical.

6. The method of claim 1, wherein a network connectivity is logical.

7. The method of claim 1, wherein a network connectivity is hybrid.

8. A method comprising:

determining, by a multi-tenant controller on a network, that a link should be established between a first channel end point and a second channel end point on the network;

if a determination is made that a link should be established between the first channel end point and the second channel end point, then generating, by the multi-tenant controller, a unique plurality of shared secrets, each shared secret of the plurality of secrets having a corresponding validity period;

transmitting, by the multi-tenant controller, the unique plurality of shared secrets to both the first channel end point and the second channel end point over a secured certificate authenticated channel;

generating a plurality of nonce values for the first channel end point and the second channel end point;

exchanging the nonce values between the first and the second channel end points;

generating a plurality of session keys for secure communication on a channel between the first channel end point and the second channel end point, wherein each session key of the plurality of session keys is generated using a shared secret of the plurality of shared secrets during its corresponding validity period and a nonce value from the first channel end point and from the second channel end point; and

refreshing the plurality of session keys at a predetermined time interval using another shared secret of the plurality of shared secrets during its corresponding validity period.

9. The method of claim 8, wherein the shared secret is generated by software.

10. The method of claim 8, wherein the shared secret is generated by hardware.

11. The method of claim 8, wherein the shared secret is generated by a software and hardware hybrid.

12. The method of claim 8, wherein a network connectivity is physical.

13. The method of claim 8, wherein a network connectivity is logical.

14. The method of claim 8, wherein a network connectivity is hybrid.

15. A system comprising:

a first site;

a second site in communication with the first site via a network;

a non-transitory memory for storing program instructions; and

a multi-tenant controller configured to execute the program instructions, configured to determine that a link should be established between the first site and the second site, configured to generate a unique common shared secret if the multi-tenant controller determines that a link between the first site and the second site should be established, and configured to transmit the shared secret to both the first site and the second site over a secured certificate authenticated channel, wherein the common shared secret is used for generating a session key for secure communication on an established link between the first site and the second site, wherein the multi-tenant controller is configured to assign a wall clock based start and end validity period for the common shared secret, and wherein the session key is generated and valid during the validity period for the common shared secret.

16. The system of claim 15, wherein the shared secret is generated by software.

17. The system of claim 15, wherein the shared secret is generated by hardware.

18. The system of claim 15, wherein the shared secret is generated by a software and hardware hybrid.

19. The system of claim 15, wherein a network connectivity is physical.

20. The system of claim 15, wherein a network connectivity is logical.